Re: [PATCH net 3/7] net/mlx5e: tc: Tie esw & accel blocking refs to the flow's lifetime

[sashiko-bot@kernel.org]

> From: Cosmin Ratiu <cratiu@nvidia.com>
> 
> TC flow creation acquires an esw user ref and, where required, an
> IPsec-blocking reference. mlx5e_delete_flower() releases these, but
> bulk cleanup (mlx5e_tc_nic_cleanup -> _mlx5e_tc_del_flow) destroys the
> remaining flows without releasing either.
> 
> When bulk cleanup runs during suspend, the core device survives with
> stale counters, which can prevent subsequent eswitch mode changes and
> IPsec offload.
> 
> For the same reason, two more bugs are that the refs are dropped in
> mlx5e_delete_flower(), before the flow is actually freed, leaving a
> window of time where:
> - a racing esw mode change could pull the rug from underneath the
>   existing flow, leading to use after free.
> - new IPsec objects might be installed, violating the restriction of
>   mutual exclusion between TC and IPsec.
> 
> To fix these issues, this patch moves the reference acquisitions in
> mlx5e_alloc_flow(), before the HW objects are actually allocated, and
> moves the reference dropping to mlx5e_tc_del_flow(), after the HW
> objects are deallocated.
> 
> Fixes: 7dc84de98bab ("net/mlx5: E-Switch, Protect changing mode while adding rules")
> Fixes: c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclusive on a netdev")
> Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917175433.4090878-1-tariqt@nvidia.com?part=3